Security advisories and post-quantum updates

Open source security lists carried multiple vulnerability disclosures spanning XML parsers, identity management, and data formats, while the PQC forum saw a new Falcon implementation for constrained devices. Apache projects featured prominently with several Syncope advisories and one for the retired Oozie.

OATH Toolkit libpskc signature verification bypass

A signature verification bypass in the OATH Toolkit libpskc component was disclosed as CVE-2026-109117. The flaw concerns PSKC signature handling via libxmlsec. Developers relying on OATH Toolkit for one-time password systems should assess impact on authentication integrity.

libexpat 2.10.0 vulnerability fixes

Libexpat 2.10.0 was released with fixes for four CVEs covering denial of service, billion laughs attacks, segfaults, and integer overflows. Maintainers of applications that parse untrusted XML should upgrade the library. The release addresses the reported issues in this widely used XML parser.

Fixed-point FN-DSA for low-RAM embedded targets

An FN-DSA (Falcon) implementation using fixed-point 32.64 arithmetic was announced on the PQC forum. The work targets low-RAM embedded use such as Cortex-M4. Developers integrating post-quantum signatures on constrained hardware may find the approach relevant.

Apache Syncope RCE via Groovy sandbox bypass

Apache Syncope disclosed CVE-2026-113687, a remote code execution issue through a ProcessGroovyMethodsSandbox bypass. Fixes shipped in versions 4.0.9 and 4.1.4. Operators of Syncope identity management deployments should apply the updates.

Apache Syncope AuthProfile value escalation

CVE-2026-110535 describes an important privilege-escalation flaw in Apache Syncope self-service profile updates. AuthProfile values can be escalated across multiple affected releases. Self-service installations need to prioritize patching to limit unauthorized privilege changes.

Apache Arrow Rust RunEndEncoded out-of-bounds reads

CVE-2026-111959 covers improper validation of RunEndEncoded arrays in Apache Arrow Rust that allows out-of-bounds reads. The moderate-severity issue has fixes released for affected versions. Rust users of Arrow should update to address the memory-safety concern.

Apache Syncope delegated administration realm bypass

Apache Syncope published CVE-2026-113511 for an authorization bypass that lets delegated administrators relocate realms across boundaries. The important flaw weakens delegated administration controls. Installations that rely on realm isolation should review and update.

Apache Oozie workflow rerun ACL bypass

CVE-2026-119641 was assigned to a moderate ACL bypass in Apache Oozie where workflow rerun bypasses per-job ACL and reassigns ownership. No fix will be issued because the project is retired. Remaining Oozie deployments should assess exposure independently.